Re: Docker

I think docker is a good example of how to NOT do things. There is a
reason why it is dying, lots of bad things have happened in docker land.

However, let me post my opinion. We can distinguish between two
different types of containerizations: system level containers and
applications level containers. Linux LXC and FreeBSD jails fall into the
former category.

OCI containers fall into the application level container category and
are moving away from the awkward Docker stack to sane solutions: podman,
containerd, cri-o etc.
The basic idea is: I have a repository which provides signed images for
the users to pull and use as a running container. For software vendors,
I can create an image which is basically a tar with the files and
layered filesystems that can be pushed to the repository. Just like a
jail, all the needed software, libraries are contained in one image, but
easier accessible for users. The container consists of filesystem layers
identified by a hash, which can be referenced to by other containers
(e.g. a Debian Linux container in its minimal edition might be the base
for the Kali Linux penetration testing container). Files that should
persist are mounted via mount_nullfs into the container. The cool thing
about that is: the images are created using a declarative manner, a yaml
file.

FreeBSD already provides lots of the technology necessary to build that
(I am not talking about running Linux containers, but FreeBSD
application level containers), however, it just lacks some glue like a
system for defining a config file from which such a container is built,
a repo, and I have no idea about how stable/performant unionfs is.
Unfortunately I have not yet had time to look at the proposed projects
of this thread.

A few use cases come to mind (well, actually much more since I have
worked with OCI/"Docker" since the beginning): "I want to host a simple
public jitsi server, do not want to go through all the config. Someone
made such a setup already and pushed that container to some repo, oh
nice, let's just pull it and run it", or maybe: "oh, I do want to use
keepass as password manager, but do not want it to be able to make
network connections. Fine, just download the container and forbid
network access." I am a lazy guy, I prefer spending my time on creating
stuff and pushing it to a repository instead of fumbling around with
ansible scripts to deploy that stuff when pushing and pulling an upgrade
is so much easier via providing self-contained images.

So, yes, I would absolutely love to see application level containers, or
such a slick framework built around the great jail solution we already
have. Passing around containers as a single binary package for FreeBSD -
one may dream ;-)

Regards,
Robert


On 13.04.23 17:43, Mario Marietto wrote:
> For sure not everything,but something that is very requested and that it
> has given a solid proof to be a valid and robust tool. I think Docker
> has all these requisites.
>